{"id":41624,"date":"2023-06-01T09:40:39","date_gmt":"2023-06-01T06:40:39","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=41624"},"modified":"2026-03-28T03:24:21","modified_gmt":"2026-03-28T00:24:21","slug":"should-i-stay-or-should-i-go-how-major-gangs-shutdown-affected-ransomware-trends-for-2023","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/should-i-stay-or-should-i-go-how-major-gangs-shutdown-affected-ransomware-trends-for-2023\/","title":{"rendered":"Should I stay or should I go: how major gangs\u2019 shutdown affected ransomware trends for 2023"},"content":{"rendered":"\n

Ransomware has been making headlines for several years in a row.\u00a0In their quest for profit, attackers have targeted almost every type of organization, from healthcare and educational institutions to service providers and industrial enterprises, affecting nearly every aspect of daily life. This year, these groups are still managing to come up with new, elaborate techniques or even attribute features of former gangs among top players that have currently ceased operations. Kaspersky has released a new\u00a0<\/strong>report<\/strong><\/a>\u00a0reviewing last year\u2019s ransomware predictions and providing insights for 2023.<\/strong><\/p>\n\n\n\n

In 2022, Kaspersky solutions detected more than 74.2M attempted ransomware attacks, a 20% increase over 2021 (61.7M). At the same time, at the beginning of 2023 we saw a slight decline in the number of ransomware attacks \u2013 however, they became more sophisticated and targeted. Moreover, the top five most influential and prolific ransomware groups have drastically changed over the last year. The deceased REvil and Conti, that placed second and third in H1 2022 respectively in terms of attacks, in Q1 2023 were replaced by Vice Society and BlackCat. The remaining ransomware groups that formed TOP5 in Q1 2023 are Clop and Royal.<\/p>\n\n\n\n

The review of last year\u2019s ransomware trends shows that all of them persisted. In the course of 2022 and at the beginning of 2023, there were several cross-platform ransomware modifications that caught researchers\u2019 eyes, such as Luna and Black Basta. Ransomware gangs have also become more industrialized, with groups such as BlackCat adjusting their techniques over the year. For now employees of victim organizations must check to see if they are listed in the stolen data, thus increasing the pressure on the affected organization to pay a ransom. The geopolitical situation has seen some ransomware groups take sides in conflicts \u2013 including the Eternity stealer. The group behind it created a whole ecosystem, with a new ransomware variant. <\/p>\n\n\n\n

For 2023, Kaspersky experts have presented three key trends for ransomware threat landscape development. The first refers to more embedded functionality used by various ransomware groups such as self-spreading functionality or an imitation of it. Black Basta, LockBit, and Play are among the most significant examples of ransomware that spreads on its own.<\/p>\n\n\n\n

The next trend to recently emerge is driver abuse for malicious purposes \u2013 an old trick. Some of vulnerabilities in AV driver were exploited by AvosLocker and Cuba ransomware families, however, Kaspersky experts\u2019 observations show that even the gaming industry can fall victim to this sort of attack. Reportedly, the Genshin Impact anti-cheat driver was used to kill endpoint protection on the target machine. And the trend continues to be watched with high-profile victims such as government institutions in European countries.<\/p>\n\n\n\n

Finally, Kaspersky experts draw attention to how the largest ransomware gangs are adopting capabilities from either leaked code, or code sold by other cybercriminals, which may improve their malware\u2019s functions. Recently LockBbit group adopted code, at least 25 percent of the leaked Conti code, and issued a new version based entirely on it. These types of initiatives provide affiliates with similarities and facilities to work with ransomware families that they were previously used to working with. Such moves can strengthen their offensive capabilities \u2013 and that should keep in mind in companies\u2019 defense strategy.<\/p>\n\n\n\n

\u201cRansomware gangs continually surprise us, and never stop developing their techniques and procedures. What we\u2019ve been watching throughout the last one and a half year is that they are gradually turning their services into full-fledged businesses. This fact makes even amateur attackers quite dangerous,\u201d <\/em>comments Dmitry Galov, senior security researcher at Kaspersky\u2019s Global Research and Analysis Team. \u201cSo, to make your business and your personal data safe, it\u2019s very important to keep your cybersecurity services updated<\/em>.\u201d<\/em><\/em><\/p>\n\n\n\n

Read the full report on\u00a0Securelist<\/a>.<\/p>\n\n\n\n

Kaspersky encourages organizations to follow these best practices that help safeguard against ransomware:<\/p>\n\n\n\n

\u00b7       Always keep software updated on all the devices you use to prevent attackers from exploiting vulnerabilities and infiltrating your network. <\/h4>\n\n\n\n

\u00b7       Focus your defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminals\u2019 connections to your network. Set up offline backups that intruders cannot tamper with. Make sure you can access them quickly when needed or in an emergency. <\/h4>\n\n\n\n

\u00b7       Enable ransomware protection for all endpoints. There is a free Kaspersky Anti-Ransomware Tool for Business<\/a> that shields computers and servers from ransomware and other types of malware, prevents exploits and is compatible with already installed security solutions. <\/h4>\n\n\n\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Install anti-APT and EDR solutions, enabling capabilities for advanced threat discovery and detection, investigation and timely remediation of incidents. Provide your SOC team with access to the latest threat intelligence and regularly upskill them with professional training. All of the above is available within\u00a0Kaspersky Expert Security framework<\/a>.<\/h4>\n\n\n\n